Article Intended For
Penn State employees, students, and other affiliates who want help choosing which multifactor authentication (MFA) method(s) best meets their needs.
Introduction
Penn State supports several ways to securely sign in to your Penn State Account using MFA. The best option for you may depend on the devices you use and how you prefer to sign in. Whichever method you choose, creating a passkey is easy and should only take a few minutes to complete.
If you are not sure which option to choose, please see the Article Body below to find the best matches based on the devices you regularly use.
NOTE: Regardless of the MFA method you choose to regularly use, it is highly recommended that you enroll a second method in the event your primary device (smartphone, tablet, FIDO2 key, etc.) is lost, stolen, or otherwise not available.
Things to Know
- YOU CAN HAVE MORE THAN ONE PASSKEY
- You can enroll multiple passkeys for your Penn State Account and use whichever one is most convenient at the time you sign in. For example, you could have:
- 1 passkey on your Android smartphone
- 1 passkey on your Windows computer using Windows Hello
- 1 passkey on a FIDO2 security key (such as a YubiKey)
- You can enroll multiple passkeys for your Penn State Account and use whichever one is most convenient at the time you sign in. For example, you could have:
- YOU ARE NOT LOCKED INTO YOUR CHOICE
- If you enroll a passkey and later decide another option works better for you, you can add another passkey or remove one you no longer want to use.
- If you enroll a passkey and later decide another option works better for you, you can add another passkey or remove one you no longer want to use.
- ONLY CONSIDER OPTIONS FOR DEVICES YOU HAVE
- For example, if you don't use an iPhone or iPad, you can skip that option. If you don't use an Android device, you can skip that option.
- For example, if you don't use an iPhone or iPad, you can skip that option. If you don't use an Android device, you can skip that option.
- YOU DO NOT HAVE TO USE FACE ID OR A FINGERPRINT
- Depending on the device, other options such as a device PIN or passcode are likely available.
- Depending on the device, other options such as a device PIN or passcode are likely available.
- YOUR BIOMETRIC INFORMATION STAYS ON YOUR DEVICE
- Penn State and Microsoft do not receive your fingerprint, facial recognition information, or device PIN. These stay on your device and are only used to verify that you want to use the passkey on the device to sign in.
- Penn State and Microsoft do not receive your fingerprint, facial recognition information, or device PIN. These stay on your device and are only used to verify that you want to use the passkey on the device to sign in.
- SYNCED PASSKEYS ARE RECOMMENDED WHEN AVAILBLE
- A passkey synced to the cloud through your Apple or Google Account can be available on other devices you are signed in with the same account. This also means your passkeys can remain available if you replace or upgrade your device.
- A passkey synced to the cloud through your Apple or Google Account can be available on other devices you are signed in with the same account. This also means your passkeys can remain available if you replace or upgrade your device.
- A PASSKEY FOR YOUR PENN STATE ACCOUNT CAN BE SYNCED USING A PERSONAL ACCOUNT
- Saving a passkey to Apple Passwords on your iPhone will sync it to the personal Apple Account you log into your iPhone with.
- Saving a passkey to Google Password Manager on your Android phone will sync it to the personal Google account you log into your Android phone with.
- Saving a passkey to a password manager like Bitwarden or LastPass will sync it to the account you created with the Bitwarden or LastPass.
- ENROLL A BACKUP MFA METHOD
- Having a second method available will allow you to still access your Penn State Account if your primary device is lost, stolen, replaced, or otherwise unavailable.
- Having a second method available will allow you to still access your Penn State Account if your primary device is lost, stolen, replaced, or otherwise unavailable.
Article Body
Which Option Should I Choose?
I use an iPhone or iPad
Choose: Apple Passwords
Your passkey is securely synced through your Apple Account and is available on other compatible Apple devices using the same account. If you lose, replace, or upgrade your device, your passkey remains available through your Apple Account.
See: MFA: Enroll a Passkey With My iPhone or iPad (synced to Apple Passwords)
I use an Android phone or tablet
Choose: Google Password Manager
Your passkey is securely synced through your Google Account and is available on other compatible Android devices using the same account. If you lose, replace, or upgrade your device, your passkey remains available through your Google Account.
See: MFA: Enroll a Passkey With My Android Phone or Tablet (synced to Google Password Manager)
I currently use a password manager
Choose: Bitwarden or LastPass
If you already use one of these supported password managers, you can store your Penn State passkey there. Your passkey will sync through your password manager and is available across your devices. As of now, 1Password does not work with Microsoft Entra SSO and will not work with your Penn State Account.
NOTE: If you currently use a password manager that is not listed above, it likely works with your Penn State Account. However, if you experience any issues while using it, Penn State IT support will not be able to assist you with it, and you will need to contact the company directly. That said, you can contact the Penn State IT Service Desk for a temporary login pass until your issue with the password manager is resolved.
See:
MFA: Enroll a Passkey and Sign In With Bitwarden Password Manager
MFA: Enroll a Passkey and Sign In With LastPass Password Manager
I want a passkey that stays only on my smartphone
Choose: Microsoft Authenticator Passkey
Microsoft Authenticator stores a device-bound passkey on your smartphone. Unlike a synced passkey, it remains only on the smartphone or tablet where it was created and does not sync to the cloud or other devices.
If your phone is lost, replaced, or reset, the passkey will not automatically be available on your replacement device.
See: MFA: Enroll a Passkey With Microsoft Authenticator (iOS or Android)
I prefer to continue entering my password
Choose: Microsoft Authenticator Number Matching
If you are not required to use phishing-resistant MFA, you can continue signing in with your Penn State password and approving the sign-in using Microsoft Authenticator.
Number matching provides strong MFA but is not phishing-resistant because your password is still used during sign-in.
NOTE: Penn State IT employees are expected to use phishing-resistant MFA and should only use number matching for systems and services that do not yet support passkeys.
See: MFA: Push Notification Enrollment
I want to use my personal Windows computer
Choose: Windows Hello
Windows Hello allows you to store a device-bound passkey directly on a supported Windows computer. You can then use your Windows Hello PIN, fingerprint, or facial recognition to verify your identity when signing in.
Because the passkey is device-bound, it remains on that computer and does not sync to other devices (such as a lab computer or a podium).
See: MFA: Enroll a Passkey in Windows Hello on a Personal Windows Computer
I want to use my personal Mac computer
Choose: Apple Passwords
If your Mac supports Touch ID, you can use it to verify your Penn State Account passkey synced to the Apple Passwords app.
See: MFA: Enroll a Passkey on a Personal macOS Computer and Use Touch ID
I use a Penn State-managed Windows computer (employees)
Choose: Windows Hello for Business
Windows Hello for Business provides phishing-resistant authentication on supported Penn State-managed Windows laptops and desktops. You can use your Windows Hello PIN, fingerprint, or facial recognition to verify your identity. While PIN is always an option, availability of fingerprint and facial recognition depends on your computer's hardware.
NOTE: If your computer is managed by the Unified Endpoint Management (UEM) group, Windows Hello for Business should be available for you to use. If your computer is not managed by UEM and you would like to use Windows Hello for Business, you will need to contact your local IT group (or whoever manages your computer) first and request that they enable it for your laptop/desktop computer. If you are not sure who that is, please contact the IT Service Desk for assistance.
See: MFA: Enroll in Windows Hello for Business on a Penn State-Managed Windows Computer
I use a Penn State-managed Mac computer (employees)
Choose: Platform SSO
Platform SSO allows you to use your Penn State-managed Mac's built-in authentication, such as Touch ID, to securely sign in to your Penn State Account.
NOTE: You will need to contact the IT group (or whoever manages your computer) first and request that they enable Platform SSO for your macOS computer. If you not sure who that is, please contact the IT Service Desk for assistance.
See: MFA: Enroll in Platform SSO on a Penn State-Managed Mac Computer
I want a separate physical device or a backup authentication method
Choose: FIDO2 Security Key (example: YubiKey)
A FIDO2 security key, such as a YubiKey, stores your passkey directly on a physical key and can be used without relying on your smartphone or computer.
A security key is also a great option for a secondary or backup authentication method. If you normally use a passkey stored on your smartphone, a registered security key provides another way to access your Penn State Account if your primary device is lost, damaged, or otherwise unavailable.
Security keys are typically inserted into a USB slot on your computer or phone (depending on whether you have a USB-A or USB-C type). Many security keys also support Near Field Communication (NFC) which is a contactless technology similar to tap-to-pay. If your smartphone supports NFC, you can sign in directly on your device by simply holding the key against your phone.
See: MFA: Enroll a Passkey With a FIDO2 Security Key (YubiKey)
I want to receive a phone call or text message
Choose: Any of the alternate methods listed above
As of February 1, 2027, Microsoft (Penn State's sign-in provider) will no longer offer telephony methods for authentication. Phone calls and SMS/text messages will no longer be available.
Where can I learn more?
You can learn more about passkeys and phishing-resistant MFA in the following KB articles: